A seemingly simple question, but valid nonetheless.
What exactly happens when a browser which does not support SNI attempts to visit a site configured to force SSL via SNI.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
That depends on how your web server reacts when receiving a HTTPS request without SNI. (If you want to test it, you can simulate a non-SNI browser with openssl. Basic HTTP protocol knowledge required.)
With IIS 10, the following happens:
If there is a "default SSL site" (a site bound to port 443 without a host name) configured, the non-SNI client will see:
This makes perfect sense:
Host:header and returns the correct content.
If there is no "default SSL site" configured, the connection will be closed.
(Source: Just tested it with an old Windows XP IE8 virtual machine.)
It won't be able to load the website, that's for sure. Which is why no large sites will move to SNI-hosted HTTPS sites anytime soon. IE6 and IE7 in XP appear to be the largest old browsers that don't support SNI.
If you can get a hold of a non-SNI supporting browsers, you can see what happens by going to https://alice.sni.velox.ch/
It also appears to matter which server software you are using. With Apache, browsers without SNI support will just get the first configured website (and a hostname mismatch warning probably).
I just tested it using IE 4.0 running on Windows NT 4 Workstation. My website, hosted at http://www.nosupportlinuxhosting.com/, loads perfectly. I'm not sure if their hosting meets the criteria above, but their "Limiations" page suggests that is the case. I'm a bit surprised the page loaded.